v6.9.0

6.9.0 (2026-04-01)

Full Changelog: v6.8.0...v6.9.0

In this release, you'll see a number of breaking changes. This is primarily due to changes in OpenAPI definitions, which our libraries are based off of, and codegen updates that we rely on to read those OpenAPI definitions and produce our SDK libraries.

Please ensure you read through the list of changes below before moving to this version - this will help you understand any down or upstream issues it may cause to your environments.

---

Breaking Changes

See the v6.9.0 Migration Guide for before/after code examples and actions needed for each change.

AI Gateway - AccountID, AccountTag, and InternalID Field Removal

The AccountID, AccountTag, and InternalID fields have been removed from all AI Gateway response types:

• AIGatewayNewResponse
• AIGatewayUpdateResponse
• AIGatewayListResponse
• AIGatewayDeleteResponse
• AIGatewayGetResponse
• DynamicRoutingNewResponse
• DynamicRoutingDeleteResponse
• DynamicRoutingNewDeploymentResponse
• DynamicRoutingNewVersionResponse
• DynamicRoutingGetResponse
• DynamicRoutingGetVersionResponse

AI Search - VectorizeName Field Removal

The VectorizeName field has been removed from all AI Search instance response types:

• InstanceNewResponse.VectorizeName
• InstanceUpdateResponse.VectorizeName
• InstanceListResponse.VectorizeName
• InstanceDeleteResponse.VectorizeName
• InstanceReadResponse.VectorizeName

AI Search - KeywordMatchMode Enum Values Changed

The KeywordMatchMode enum values have been renamed:

• KeywordMatchModeExactMatch → KeywordMatchModeAnd
• KeywordMatchModeFuzzyMatch → KeywordMatchModeOr

Affects InstanceNewParams and InstanceUpdateParams.

Billing - New PayGo Usage Endpoint

NEW: Added billing.Usage service with PayGo endpoint:

• client.Billing.Usage.Paygo() - Returns billable usage data for PayGo (self-serve) accounts

Note: The PayGo endpoint parameters (From, To) are now the primary query mechanism. The previously available LastMonthPeriodStart and LastYearPeriodStart parameters were removed in the underlying API specification.

Connectivity - TCP Service Support

The directory services now support TCP service configurations via discriminated union types:

• ServiceConfig is now a discriminated union of HttpServiceConfig and TcpServiceConfig
• New TcpServiceConfig type with tcp_port and app_protocol fields
• HttpServiceConfig and TcpServiceConfig both extend ServiceCommon base type

Custom Hostnames - Hostname Parameter Type Change

The Hostname parameter in CustomHostnameListParams has changed from a simple string to a structured object:

• Before: Hostname param.Field[string]
• After: Hostname param.Field[CustomHostnameListParamsHostname] (object with Contain field)

AI Search - InstanceItem Service Methods Removed

The InstanceItem service methods have been removed. The service structure still exists at client.AISearch.Instances.Items but no longer provides any methods:

• List() - List indexed items in an AI Search instance
• ListAutoPaging() - Auto-paging list method
• Get() - Get a specific indexed item
• All associated response types (InstanceItemListResponse, InstanceItemGetResponse, etc.)

Workers - Filter Type Changes

The observability telemetry filters have been restructured:

• Filter types changed from QueryFilter[] to FilterNode[] (discriminated union)
• Filters now support nested groups via kind: 'group'
• Affects telemetry endpoints: keys, query, and values

Workers - Domain Service Return Type Changes

The workers.Domain service methods now return specific response types instead of the generic Domain type:

• Update() returns *DomainUpdateResponse instead of *Domain
• List() returns pagination.SinglePage[DomainListResponse] instead of pagination.SinglePage[Domain]
• Delete() now returns (*DomainDeleteResponse, error) instead of just error
• Get() returns *DomainGetResponse instead of *Domain

Zero Trust - NetworkSubnet Response Type Consolidation

The NetworkSubnet service methods now use the shared Subnet type instead of endpoint-specific response types:

• NetworkSubnetService.List() returns Subnet instead of NetworkSubnetListResponse
• NetworkSubnetWARPService.New() returns Subnet instead of NetworkSubnetWARPNewResponse
• NetworkSubnetWARPService.Edit() returns Subnet instead of NetworkSubnetWARPEditResponse
• NetworkSubnetWARPService.Get() returns Subnet instead of NetworkSubnetWARPGetResponse
• NetworkSubnetCloudflareSourceService.Update() returns Subnet instead of NetworkSubnetCloudflareSourceUpdateResponse

The removed types (NetworkSubnetListResponse, NetworkSubnetWARPNewResponse, etc.) have been consolidated into the shared Subnet type.

Zero Trust - MfaBypass Field Removal

The MfaBypass field has been removed from MFA configuration types across multiple services:

Affected Param Types:

• AccessApplicationNewParamsBodySelfHostedApplicationMfaConfig.MfaBypass
• AccessApplicationUpdateParamsBodySelfHostedApplicationMfaConfig.MfaBypass
• AccessApplicationPolicyNewParamsMfaConfig.MfaBypass
• AccessApplicationPolicyUpdateParamsMfaConfig.MfaBypass
• AccessApplicationPolicyTestNewParamsPoliciesObjectMfaConfig.MfaBypass
• AccessPolicyNewParamsMfaConfig.MfaBypass
• AccessPolicyUpdateParamsMfaConfig.MfaBypass

Affected Response Types:

• All corresponding MfaConfig response types

Zero Trust - MfaConfigurationAllowed Field Removal

The MfaConfigurationAllowed field has been removed from Organization types:

• OrganizationNewParams.MfaConfigurationAllowed
• OrganizationUpdateParams.MfaConfigurationAllowed
• OrganizationNewResponse.MfaConfigurationAllowed

---

Features

AI Search - BoostBy Field Addition

The BoostBy field has been added to retrieval options across multiple response types:

• InstanceNewResponseRetrievalOptions.BoostBy
• InstanceUpdateResponseRetrievalOptions.BoostBy
• InstanceListResponseRetrievalOptions.BoostBy
• InstanceDeleteResponseRetrievalOptions.BoostBy
• InstanceReadResponseRetrievalOptions.BoostBy

Browser Rendering (client.browserRendering)

• Crawl: New endpoints for headless browser crawling
  • Create() - Start a crawl job
  • List() - List crawl jobs
  • Get() - Get crawl job details
  • Update() - Update crawl job
  • Delete() - Delete crawl job
  • Screenshot() - Take screenshots during crawl
  • Scrape() - Scrape content during crawl

Brand Protection v2 (client.brandProtection.v2)

• New v2 API endpoints:
  • Logo - Logo management
  • LogoMatch - Logo matching
  • Match - Brand protection matching
  • Query - Query brand protection data

Google Tag Gateway (client.googleTagGateway)

• NEW SERVICE: Manage Google Tag configurations
  • Config.Create(), Update(), List(), Delete(), Get()

Resource Tagging (client.resourceTagging)

• NEW SERVICE: Resource tagging management
  • AccountTag management
  • Key management for resource tagging

Zero Trust Device IP Profiles (client.zeroTrust.devices.ipProfiles)

• IP profile management for device posture
  • Create(), Update(), List(), Delete(), Get()

Abuse Reports

• Mitigation responses now include additional metadata fields

Accounts

• managed_by field with parent_org_id, parent_org_name support

AI Gateway

• zdr field added to all responses and params
• Dataset, evaluation, log, and provider config endpoints updated

AI Search

• Instance management expanded with new fields
• Job management enhancements
• Token management updates

API Gateway

• Configuration and user schema updates
• Expression template fallthrough improvements

D1

• Database query and raw query parameter refinements
• Time travel support: GetBookmark(), Restore()

DNS

• dns_records/usage endpoints added
• Record type improvements

Email Security

• Enhanced investigation endpoints
• New fields: envelope_from, envelope_to, postfix_id_outbound, replyto
• New detection classification: outbound_ndr

Logpush

• New datasets: dex_application_tests, dex_device_state_events, ipsec_logs, warp_config_changes, warp_toggle_changes

Magic Transit

• App and connector enhancements
• CF interconnect improvements
• License key and provisioning support

Organizations

• Organization account management improvements
• Hierarchical organization support

R2

• Super Slurper job enhancements
• Job log improvements

Rulesets

• Buffering fields: request_body_buffering, response_body_buffering

Workers

• Subdomain deletion support
• Script observability settings
• Tags and tail consumers support

Workflows

• Instance retention configuration
• New status option: restart

Zero Trust

• MCP portal and server configuration updates
• Access application type enhancements
• Gateway proxy endpoint improvements
• Tunnel connection updates

---

Deprecations

None in this release.

---

Bug Fixes

• AI Search: Fixed test compatibility issues
• Billing: Transport error handling improvements
• Client: Retry logic error passing fixes

v6.8.0

6.8.0 (2026-02-27)

Full Changelog: v6.7.0...v6.8.0

Breaking Changes

See the v6.8.0 Migration Guide for before/after code examples and actions needed for each change.

• CloudforceOne.ThreatEvents — Delete() method removed
• SSL.CertificatePacks — List() pagination type changed from SinglePage to V4PagePaginationArray
• ZeroTrust.DLP.Datasets — New(), Update(), Get() return types replaced with shared DLP types
• ZeroTrust.DLP.Datasets.Upload — New(), Edit() return types replaced with shared DLP types
• ZeroTrust.DLP.Profiles — Get() return type replaced with shared Profile type
• ZeroTrust.DLP.Profiles.Custom — New(), Update(), Get() return types replaced with shared Profile type
• ZeroTrust.DLP.Profiles.Predefined — Update(), Get() return types replaced with shared PredefinedProfile type

Features

New API Resources

• ACM.CustomTrustStore - Manage custom origin trust store certificates per zone
• EmailSecurity.Phishguard.Reports - List phishing reports via Email Security Phishguard
• Radar.PostQuantum - Post-quantum encryption analytics including origin adoption (Origin.Summary, Origin.TimeseriesGroups) and TLS support (TLS.Support)
• ZeroTrust.Access.Users - Manage Zero Trust Access user identities
• ZeroTrust.DEX.Rules - Manage DEX rules for device testing
• ZeroTrust.Gateway.Pacfiles - Manage Gateway PAC file configurations
• ZeroTrust.Networks.Subnets.WARP - Manage WARP subnet exclusions

New Endpoints (Existing Resources)

Radar.Entities.ASNs

• BotnetThreatFeed() - Retrieve botnet threat feed data for ASNs from Cloudflare Radar

v6.7.0

6.7.0 (2026-02-10)

Full Changelog: v6.6.0...v6.7.0

Features

• fraud: add new fraud detection API package
• ai_gateway: add dynamic routing endpoints for AI Gateway
• ai_gateway: add provider configuration management
• ai_search: add chat completions endpoint
• ai_search: add search endpoint
• ai_search: add custom metadata field support
• ai_search: add specific sitemaps configuration for web crawler
• acm: add Update method for Total TLS settings (upsert pattern)
• images: add metadata filtering support for image listings with operators (eq, in) and nested fields
• magic_transit: add bond_id field to site LAN configuration
• cloudforce_one: add cursor-based pagination for threat events (for deep pagination beyond 100k records)
• cloudforce_one: add includeCreatedEvents option to bulk threat event creation
• cloudforce_one: add datasetId field to threat event responses
• zero_trust: add secure_web_gateway field to MCP portal configuration
• email_security: add ids field for bulk move operations (replaces postfix_ids)

Bug Fixes

• acm: rename New method to Edit for Total TLS settings to match API semantics
• ai: add missing string union variants for AI run response types
• ai: correct ToMarkdown transform method signature to use params instead of separate file parameter
• custom_certificates: make bundle_method and other fields optional in response
• custom_certificates: restructure edit params with proper union types
• kv: change value field to support binary data in namespace value updates
• d1: mark batch field as required for multiple queries
• email_security: update bulk move documentation to specify 100 message limit
• origin_tls_client_auth: restructure to use proper subresource pattern
• workflows: properly type timeout and delay fields as unions (string or number)
• workers: correct Mode types
• browser_rendering: correct test URLs
• cloudforce_one: remove preserveUuid parameter (replaced by includeCreatedEvents)
• cloudforce_one: remove uuid field from threat event creation parameters
• radar: correct CT data source constant name casing

Chores

• intel: remove deprecated IP list endpoint and associated types
• update version to 6.7.0
• tests: skip problematic AI ToMarkdown transform tests
• api: extensive API specification updates across all packages

v6.6.0

6.6.0 (2025-01-15)

Full Changelog: v6.5.0...v6.6.0

Breaking Changes

• browser_rendering: refactor request body parameters to use proper union types

  The models were updated to be accurate to what the API expects, so there are parameter changes
  across most of the sub-resources under the browser_rendering umbrella.

Features

• ai_search: add hybrid search and public endpoint support
• ai_gateway: add is_default field to gateway configurations
• cloudforce_one: add UUID support, STIX2 format, and async indicator processing
• custom_pages: add waf_challenge identifier support
• email_security: add async polling support with Location header and success field
• magic_cloud_networking: expand type definitions for catalog sync, cloud integration, and onramp
• realtime_kit: add comprehensive meeting, preset, recording, session, and webhook endpoints
• rulesets: add request and response body buffering configuration options
• stream: add properly typed download responses with status tracking
• workers: add targeted placement support with host, hostname, and region options
• workers_for_platforms: enhance dispatch namespace script settings types
• workflows: add properly typed instance_retention parameter with error and success retention
• zones: refactor subscription responses to use dedicated types

Chores

• addressing: add auto_generated field to LOA document responses
• custom_hostnames: make SSL parameter optional in create requests
• email_security: deprecate item_count field in move responses
• hyperdrive: improve documentation for caching and port configuration
• pages: refactor project and deployment type definitions
• shared: add union type implementations and documentation updates
• zero_trust: simplify DLP shared entry types by removing entry_type unions

v6.5.0

6.5.0 (2025-12-17)

Full Changelog: v6.4.0...v6.5.0

Features

• ai_gateway: add zdr field (f85b933)
• ai_search: add AI Search endpoints (9d95c4b)
• leaked_credentials_check: Add GET endpoint for leaked_credentials_check/detections (2c4f6f5)
• magic_transit: support custom remote identities (f85b933)
• r2: add keys to super slurper response types (f85b933)
• radar: support filtering results by agent type (2020995)
• workers: add startup_time_ms to version types (f85b933)
• zero_trust: support new gateway list types (2020995)

Chores

• accounts: docs, tests updates (f85b933)
• api_gateway Deprecate API Shield Schema Validation resources (ae8644c)
• internal: codegen related update (d2d0a29)
• load_balancers: update pool, monitor nullability (2020995)
• zero_trus: refactor DLP entry types (23fdbc6)

v6.4.0

6.4.0 (2025-12-04)

Full Changelog: v6.3.0...v6.4.0

Features

• feat(r2_data_catalog): Configure SDKs/Terraform to use R2 Data Catalog routes (d1b1eab)
• feat(silences): add a new alert silencing api (fbe4969)
• feat(account_auditlog): Added ID field to LogAuditListParams (deprecates AuditLogID)
• feat(browser_rendering): Added Meta field to SnapshotNewResponseEnvelope
• feat(cloudforce_one):

• Added HasChildren field to threat event response types
• ThreatEventBulkNew returns structured response with CreatedEventsCount, CreatedIndicatorsCount, CreatedTagsCount, ErrorCount
• Removed required IndicatorType field from ThreatEventNewParams

• feat(email_security): Added fields to InvestigateListResponse and InvestigateGetResponse: EnvelopeFrom, EnvelopeTo, PostfixIDOutbound, Replyto
• feat(r2):
  • Added generic S3-compatible provider support to Sippy (SippySourceProviderS3)
  • Added BucketURL field to SippySource
  • Added BucketSippyUpdateParamsBodyR2EnableSippyS3 for S3-compatible sources

Bug Fixes

• fix(iam): properly unwraps envelope response

Chores

• api: update composite API spec (813b47b)
• api: update composite API spec (86f0a73)
• internal: codegen related update (4548d4d)

Breaking Changes

• pages: return types changed for all project and deployment methods - Project and Deployment shared types replaced with method-specific response types.
  • Projects.New now returns ProjectNewResponse (was Project)
  • Projects.List now returns ProjectListResponse (was Deployment)
  • Projects.Edit now returns ProjectEditResponse (was Project)
  • Projects.Get now returns ProjectGetResponse (was Project)
  • Projects.Deployments.New now returns ProjectDeploymentNewResponse (was Deployment)
  • Projects.Deployments.List now returns ProjectDeploymentListResponse (was Deployment)
  • Projects.Deployments.Get now returns ProjectDeploymentGetResponse (was Deployment)
  • Projects.Deployments.Retry now returns ProjectDeploymentRetryResponse (was Deployment)
  • Projects.Deployments.Rollback now returns ProjectDeploymentRollbackResponse (was Deployment)
  • Removed shared types Deployment, Project, DeploymentParam, ProjectParam, StageParam

Deprecations

• account_auditlog: Depractes AuditLogID in favor of ID field to LogAuditListParams (deprecates AuditLogID)

v6.3.0

6.3.0 (2025-11-19)

Full Changelog: v6.2.0...v6.3.0

Features

• mcp_portals: enable sdks generation (c582b3d)
• iam: add SSO Connectors resource to SDKs (a6cadb2)
• config: add token validation to stainless config (f733821)
• workers: expose subdomain delete (159aba7)
• abuse_reports: expose new abuse report endpoints (GET and LIST) (b5e8f16)
• tomarkdown: add new markdown supported endpoint (6737d33)
• abuse_reports: add abuse mitigations in client API (e25cf5d)
• pipelines: configure SDKs/Terraform to use the new Pipelines, Streams, Sinks routes (47fe62a)
• dlp: switch DLP Predefined Profile endpoints (496a17a)
• addressing_load: add deprecation to LOA api (2d0f886)

Bug Fixes

• schema: correctly reflect schema validation model mapping (e13a4b0)
• ai_controls: incorrect use of standalone_api (12b2f77)
• wvpc: move to connectivity module (30e2d15)
• realtime-kit: tabbing on realtime-kit api resources (b0f08de)

Chores

• internal: codegen related update (46aa6df)
• api: update composite API spec (dbd3501, 9d98e16, 1505c81, 8675c4c, b5bbbe9, 38a87ce, fe3eb4e, 3d6daa1, b47aab6, 974bd02, 3d0ffd6, 73536a3, e262a8c, 7f1df0a, 5142652, 75f93c0, 50f68e8, 2392214, 2d6e9a1, ad22ee9, e249bb7, 682d37e, 8eb7d7e, d9a67b9, 7b8206b, e482bcb, 177205f, e10f556, a148439, 8c76499, 58c65f1, 55d06fc, abfc0fa)

v6.2.0

6.2.0 (2025-10-22)

Full Changelog: v6.1.0...v6.2.0

Features

• zero_trust: add tenant support (511b36f)
• zero_trust: add connectivity directory service support (eb26e21)
• organizations: SDKs for Organizations and OrganizationsProfile (1dbce03)
• zero_trust: add MCP portals support (6f3b557)
• radar: add new group by dimension support (1dcc5a6)
• content_scanning: add content scanning support (1e28d33)
• abuse: add abuse report support (c0d3b38)
• queues: add subscription read support (3f6d26f)
• zero_trust: add target attributes support (3f6d26f)
• accounts: add managed by support (d86239b)
• leaked_credential_checks: add support for user defined patterns (d86239b)
• magic_transit: add support for bonds in connector snapshots (d86239b)
• organizations: add support for deleting orgs (d86239b)
• queues: add support for reading consumers (d86239b)
• queues: add bulk message push support (d86239b)
• queues: add event subscription support (d86239b)
• radar: add new ctlog fields (d86239b)
• secrets_store: support new scopes (d86239b)
• workers: add support for observability telemetry support (d86239b)
• zero_trust: add mcp portal support (d86239b)
• zero_trust: add new fields to logs request (d86239b)
• alerting: add support for abuse reports (da98270)
• email_security: support additional fields (da98270)
• organizations: add list support (da98270)
• workers: add references support (5fc3d87)

Bug Fixes

• zero_trust: fix return types for connectivity directory service (fdb4538)
• custom_pages: fix identifier types (d86239b)

Chores

• radar: deprecate to_markdown resources (1dcc5a6)
• cloudforce_one: deprecate threat event read support in favor of datasets (8b1203b)
• rulesets: deprecate mirage support (8b1203b)
• r2: bucket notification rules are required (3f6d26f)
• rulesets: deprecate Cloudflare app support (3f6d26f)
• radar: deprecate AI bot summary UA support (fdb4538)
• workers: drop tail consumer binding type (d86239b)
• workers_for_platforms: drop tail consumer binding type (d86239b)
• zero_trust: dlp profile ID is not required (d86239b)
• pages: update project types (500840e)
• pipelines: deprecate several operations in favor of Streams API (4fa18b7)

v6.1.0

6.1.0 (2025-09-30)

Full Changelog: v6.0.1...v6.1.0

Features

• Add load balancer monitor groups endpoints (13e12e5)
• Add Radar AS-SET lookup endpoint (a0017de)
• Add organizations and account-specific profile & orgs APIs (5022bf1)
• Add to_markdown subresource to AI resource (7626bca)
• Add Zero Trust network hostname route endpoints (4390272)
• Rename duplicate parameter in the to_markdown subresource (07b0d52)
• Deprecate Radar AI inference and leaked credential endpoints (a96e487)
• Remove created_at and updated_at fields from Zero Trust organization (9c36264)

Bug Fixes

• bugfix for setting JSON keys with special characters (7c0a952)

Chores

• bump minimum go version to 1.22 (5c4c9b6)
• do not install brew dependencies in ./scripts/bootstrap by default (e12cc47)
• internal: codegen related update (f2abb93)
• api: update composite API spec (51c768e, e412469, 9143c15, 6606609, f69358a, a49490d, 4e23103, df8a5c6, 846f97f, f6a3e5c, fecd84e, a8ad675, 5d1e96a, 71117ac, 4922672, d3c0858, d366730, 5288377, 667a491, c7efc70, 8ae52b8, 9388bec, 5667889, 0018f12, 271377b, 89c938e, 0518e49, 5d9e625, b6c7c9a, c9a413b, e43e106, 1a80c32, f845ab3, 81d331b, bdc4f1f, e832470, 69aa208, 3cbd246)

v6.0.1

6.0.1 (2025-09-11)

Full Changelog: v6.0.0...v6.0.1

Bug Fixes

• client: custom fix to rename Body io.Reader param to file (e845c6d)
• correctly handle sending multipart/form-data requests with JSON (98bbcaa)
• remove null from release please manifest (e3d2798)
• use release please annotations on more places (63ded25)

Chores

• client: add back Body param to AIToMarkdownNewParams (6a2f9b5)
• internal: codegen related update (049772e)
• Skip workers prism test (8bda71e)